ISO 27701:2025 Privacy Information Management
ISO 27701 for financial services
Banks, insurers, fiduciaries and their service providers are asked more often to show how they handle personal data. ISO 27701 answers that with a certificate your client can verify. With Zertify you complete an online self-assessment and receive the certificate usually within 4 hours after passing and payment.
01: Demand
Why do clients in financial services ask for ISO 27701?
Financial firms hold salary data, account details, insurance claims and tax records. When one of them buys a service, the purchasing department wants to know who processes this data, where, and under which rules. The usual result is a supplier questionnaire with several pages of privacy questions.
A certificate attached to your quote shortens that exchange. The reader sees the standard, the certificate number and a QR code on the PDF that leads to a public verification page. The questionnaire may still arrive, but many of its questions are answered before they are asked.
In tenders, proof of a privacy management system can appear as a requirement or as a scoring criterion. If you supply software, payroll, fiduciary work or IT operations to financial clients, you meet this question from the supplier side.
02: Key terms
Which privacy terms matter in a financial services firm?
ISO 27701 uses a small set of terms. In financial services each one has a recognisable form in daily work.
- Controller
- The firm decides why and how personal data is used. A bank deciding which data it needs to open an account, or an insurer assessing a claim, acts as controller.
- Processor
- The firm handles data on behalf of a client. A fiduciary running payroll for a customer, or a software provider hosting a loan application tool for a lender, is a processor.
- Record of processing activities
- A maintained list of what data is processed, for what purpose, by whom and for how long. For an insurance broker it covers applications, policy files and claims correspondence.
- Data subject request
- A client asks for a copy of their data or for correction or deletion. The firm needs a named owner, a deadline and a way to find the data in every system.
- Personal data breach
- Loss, disclosure or alteration of personal data. A statement sent to the wrong recipient is already one.
03: Requirements
How does a financial services firm meet the key requirements?
The standard sets out what a privacy management system must achieve. It does not prescribe tools. The table shows how a small or mid-sized financial firm can meet each key requirement with ordinary means.
| Requirement | Example in a financial services firm | Typical evidence |
|---|---|---|
| Determine the role as controller or processor | An asset manager is controller for its own clients and processor for a mandate it administers on behalf of another firm. | Role list per service, referenced in contracts |
| Assess and treat privacy risks | A fiduciary rates the risk of sending tax files by unencrypted email and moves them to a secure client portal. | Risk register with measures and owners |
| Maintain a record of processing activities | A broker lists applications, policy files and claims correspondence with purpose and retention period. | Current record, reviewed at fixed intervals |
| Fulfil data subject rights on time | A client asks for deletion of an old loan enquiry. The request is logged, checked against retention duties and answered within the deadline. | Request log with dates and outcomes |
| Implement privacy by design and by default | A new onboarding form asks only for fields the service needs. Optional fields stay empty by default. | Design checklist for new forms and tools |
| Detect and notify personal data breaches | Staff report a misdirected statement to a named contact the same day. The contact decides on notification. | Incident procedure and incident log |
04: Who needs it
Who in financial services should consider certification?
Fiduciary and accounting firms, insurance brokers, independent asset managers and loan intermediaries handle sensitive personal data in volume, usually with small teams. They rarely have a dedicated privacy officer. A short, structured assessment gives them a fixed point to work against.
Providers to the sector benefit just as much: SaaS vendors serving banks, payroll and HR service providers, outsourced IT operations. Their clients ask for proof before signing.
The 2025 edition of ISO 27701 is a stand-alone management system standard. You can be certified without ISO 27001. If you already run an ISO 27001 information security management system, much of your documentation carries over, for example risk assessment, incident handling and supplier control. The 2019 edition, by contrast, extends an ISO 27001 system and requires one.
05: With Zertify
How does Zertify issue the ISO 27701 certificate?
Zertify certifies on the basis of an online self-assessment. There is no on-site audit. Zertify issues the certificate under licence from SICE (Swiss Institute of Certification and Education), and SICE reviews every assessment before the certificate is issued. A short online re-audit confirms it every year, and the certificate is valid for 3 years.
The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The subscription renews automatically and can be cancelled at any time to the end of the current year in the customer account. If you cancel, the certificate ends with the paid year. Booking two standards gives 20% off, three or more 30%, also on the yearly fee. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. You do not need an account to buy.
Every certificate can be checked publicly by number and QR code, which is what a client's purchasing department or an auditor will do. If a client insists on the classic route with an on-site audit by a certification body, the guide on certification routes shows the differences.
06: Assessment
What does the self-assessment ask and when do you pass?
The assessment for ISO 27701 has 42 yes/no questions. Answer them with the people who know your processes: the managing partner, whoever runs IT, and whoever handles client requests.
Answer 42 questions
They follow the requirements of the standard, from your role as controller or processor to breach handling.
Meet the 15 must-meet questions
These are requirements of the standard itself. All 15 must be answered yes.
Reach 18 yes answers among the other 27
This is the second condition for passing. Where an answer is no, you know which topic to fix first.
Pay and receive the certificate
The certificate arrives usually within 4 hours after passing and payment. Attach it to quotes and supplier questionnaires and link to the verification page.
The assessment itself is free, so you can see where you stand before you decide.
07: FAQ
Questions about ISO 27701 for financial services
It depends on the client. Some name it in the supplier questionnaire or in the tender text, others ask only for a description of your privacy measures. Check the documents you received. A certificate with a public verification page answers both kinds of request.
Not for the 2025 edition, which is a stand-alone standard. The 2019 edition extends an ISO 27001 system and requires one. If you already have an ISO 27001 system, you can reuse much of it.
No. The certificate shows that you run a privacy management system and can demonstrate accountability. It is not legal advice and not an approval of individual processing activities. Legal questions stay with your own counsel.
Yes. The questions concern how you work, not how large you are. A firm that knows its role, keeps a record of processing activities and has a procedure for client requests and incidents is in a good position.
Every certificate carries a number and a QR code. Your client enters the number or scans the code on the PDF and sees the verification page of the certificate.
08: Guide
Related pages
Check where your firm stands on ISO 27701
Answer 42 yes/no questions and see which requirements you already meet.
Free and without registration.